6.5

CVE-2020-25015

Exploit
A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Genexis ≫ Platinum 4410 Firmware Versionp4410-v2-1.28
   Genexis ≫ Platinum 4410 Version2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.1% 0.861
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://packetstormsecurity.com/files/159936/Genexis-Platinum-4410-P4410-V2-1.28-Missing-Access-Control-CSRF.html
Third Party Advisory
Exploit
VDB Entry
https://www.getastra.com/blog/911/csrf-broken-access-control-in-genexis-platinum-4410/
Third Party Advisory
Exploit
https://www.jinsonvarghese.com/broken-access-control-csrf-in-genexis-platinum-4410/
Third Party Advisory
Exploit